0

My url is:

http://localhost:4567/Test/Callback#state=test&access_token=....

But when calling Request.Url.ToString(); it just outputs

http://localhost:4567/Test/Callback

How can I get the full url send to the server?

Community
  • 1
  • 1
Holding Fish
  • 99
  • 1
  • 1
  • 6

5 Answers5

17

You can't.

There is a big difference between hash (#) and query string (?). The query string is send to the server, the hash isn't.

So the url send to the server is: http://localhost:4567/Test/Callback.

The only option you have to get the 'hash' to the server is by using a query string:

http://localhost:4567/Test/Callback?state=test&access_token=...
Patrick Hofman
  • 153,850
  • 22
  • 249
  • 325
8
var uri = new Uri("http://localhost:4567/Test/Callback#state=test&access_token=....");

// Contains the query
uri.Fragment

Results in: 

#state=test&access_token=....

Edit:

To get the current url of website use:

Request.Url.AbsoluteUri;

In the Request.Url is all the information of the current page and in Request.UrlReffer everything from the previous page.

Note: Request.UrlReferrer is null when there is no previous request (from your website)

Jamie
  • 3,031
  • 5
  • 36
  • 59
2
var url=@"http://localhost:4567/Test/Callback#state=test";
var uri = new Uri(url);
var result = uri.Fragment;
Giannis Paraskevopoulos
  • 18,261
  • 1
  • 49
  • 69
1

Others have already posted answers to your specific problem.

But it seems like you are developing an ASP.NET website so you should consider using the standard ? instead of # to prefix your query string.

This will allow you to use built-in methods and properties for processing the query string and avoid custom error-prone string processing:

string queryString = Request.Url.Query; // gives you "state=test&access_token=...."

or access it as a NameValueCollection:

string state = Request.QueryString["state"]; // gives you "test"
Saeb Amini
  • 23,054
  • 9
  • 78
  • 76
  • For some reason, OAuth providers seem to return a fragment (#) containing the access token, instead of using a query string (?). I've seen the issue in ForgeRock, and it looks like the Google OAuth works the same way. I have no idea why they settled on this as a standard. – GalacticCowboy Jun 18 '21 at 14:30
  • @GalacticCowboy the reason is increased security. `#` fragments solely exist client-side and are not transferred over the network, and because the specific OAuth flow you are using is meant for client-side apps (implicit flow I'm guessing), there is no need for the server to access it anyway, so it makes sense. See [this](https://stackoverflow.com/questions/16733863/oauth2-0-implicit-grant-flow-why-use-url-hash-fragments) for a bit more info. There's also the authorization code flow (now recommended everywhere) you could use where the server gets the access token instead. – Saeb Amini Jun 20 '21 at 23:41
1

you can use javascript to get the full link then pass it to the code behind 

<script language="javascript" type="text/javascript">

    function JavaScriptFunction() {
        document.getElementById('<%= hdnResultValue.ClientID %>').value = document.URL;
    }

</script>

<asp:HiddenField ID="hdnResultValue" Value="0" runat="server" />
        <asp:Button ID="Button_Get" runat="server" Text="run" OnClick="Button_Get_Click" OnClientClick="JavaScriptFunction();" />

then from the code behind get the value of hiddenfield which contains the current full URL

protected void Button_Get_Click(object sender, EventArgs e)
{
   string fullURL = hdnResultValue.Value;
   string URl = fullURL .Substring(fullURL .IndexOf('#') + 1);
}

good luck

Ahmed Mandour
  • 330
  • 1
  • 8